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SUBJECT:  Oversight  Report  on  Quality  Control  Review  of  Defense  Contract  Audit 
Agency  and  KPMG  LLP  Office  of  Management  and  Budget  Circular 
A-133  Audit  Report  of  SRI  International,  Fiscsd  Year  Ended 
December  25, 1999  (Report  No.  D-2002-6-003) 


We  are  providing  this  report  for  your  information  and  use.  The  Defense 
Contract  Audit  Agency  (DCAA)  and  the  firm  of  KPMG  LLP  performed  the  single  audit 
for  SRI  mternatitnial,  located  in  Menlo  ^rk,  California.  The  audit  is  required  By  the 
Office  of  Management  and  Budget  (0MB)  Circular  A-i33,  “Audits  of  States,  Local 
Governments,  and  Non-Profit  C^amzatioas’^  (Circular  A-133).  SRI  International,  an 
indqwndent  non-profit  research  institute,  provides  science  and  business  based  research. 
SRI  International  emended  $131.4  miRipn  in  Federal  awards  under  the  Research  and 
Development  cluster  during  the  fiscal  year  ended  December  25,  1999.  Offiie 
$131.4  million,  $92.0  million  was  expended  for  DoD  research  programs. 

(Quality  Ctmtrol  Review  Objective,  As  the  cognizant  Federal  ag^cy  for  SRI 
Intonational,  the  Office  of  the  Inspector  Generm  (OlG),  DoD,  p^ormed  a  quali^ 
control  review  to  determine  whetiier  the  FY  1999  report  that  SRI  Intemationm 
submitted  to  the  Single  Audit  Clearinghouse  met  die  applicable  rqiorting  standards  and 
0MB  Circular  A-133;  and  whether  STMO  LLP  and  DCAA  conducted  die  audit  as 
r^ired  by  applicable  standards  and  0MB  Circular  A-133.  See  Appendix  A  for  a 
discussion  of  the  scope,  prior  quality  control  reviews  related  to  DCAA  and  KPMG 
LLP,  and  single  audit  r^uirements. 

Review  Results,  KPMG  LLP  complied  with  0MB  Circular  A-133  in  p^forming  die 
financial  statement  audit.  DCAA  generally  complied  With  0MB  Circular  A-133  in 
performing  the  audit  of  internal  controls  tmd  compliance  r^uirements,  excq[)t  auditors 
did  not  prqperly  review  work  perfmmed  by  technical  Specialists  to  ensure  toat  it  was 
adequately  perfom^  to  answer  the  audit  Objectives  M  three  of  nine  applicable 
compliance  retirements  OBligibility,  Procurement  and  Suspension  and  Debarment,  and 
Sub-r«:ipient  Mmiitoring)  finding  A).  Also,  DCAA  aucfitbrs  did  not  pr^qparly  plan 
and  document  the  OMB  Circular  A-133  audit  (Findiug  B).  SRI  International  conqilied 
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with  all  0MB  Circular  A- 133  reporting  requirements,  except  the  Schedule  of 
Expenditures  of  Federal  Awards  did  not  identify  sub-recipient  and  pass-through 
expenditures,  and  the  Corrective  Action  Plan  did  not  specify  a  plaimed  completion  date 
or  point  of  contact  (Finding  C). 

Finding  A.  Oversight  of  Work  Performed  by  Technical  Specialists.  DCAA 
auditors  did  not  ensure  that  work  performed  by  Defense  Contract  Management  Agency 
(DCMA)  technical  specialists  adequately  answered  the  objectives  of  the  assigned 
compliance  requirements.  This  condition  occurred  because  DCAA  auditors  did  not 
follow  the  requirements  in  the  DCAA  Contract  Audit  Manual  related  to  using  the  work 
of  technical  specialists.  As  a  result,  DCAA  auditors  relied  on  work  performed  by 
technical  specialists  that  may  not  have  answered  the  compliance  requirement  objectives. 

The  DCAA  Contract  Audit  Manual  states: 

"To  satisfy  certain  of  the  requirements  [related  to  evaluation  of  work  performed  by 
others],  access  to  working  papers  is  required.  Accordingly,  make  arrangements  to 
ensure  that  working  papers  will  be  available.  Evaluation  of  the  work  product  should  be 
based  on  a  comparison  of  the  audit  steps  the  DCAA  auditor  believes  are  necessary  to 
those  that  are  performed.  If  the  DCAA  auditor  concludes  that  audit  program  steps 
essential  to  developing  evidence  to  support  an  unqualified  opinion  have  not  been 
performed,  those  additional  steps  must  be  performed  by  the  auditor  before  issuing  an 
audit  report."  The  Contract  Audit  Manual  also  states  that  when  a  technical  specialist  is 
used,  “It  is  the  auditor’s  responsibility  to  examine  the  technical  evaluation  report  to 
ensure  a  reasonable  understanding  of  the  actual  work  performed.  The  auditor’s 
working  papers  must  document  (1)  the  auditor’s  understanding  of  the  actual  work 
performed,  and  (2)  the  degree  of  reliance  the  auditor  placed  on  the  technical  evaluation, 
including  its  impact  on  the  results  of  audit.” 

DCAA,  KPMG  LLP,  and  DCMA  effectively  coordinated  the  audit  approach,  including 
determining  which  organization  was  responsible  for  auditing  SRI  International’s 
compliance  with  each  requirement  in  0MB  Circular  A- 133  Compliance  Supplement. 
However,  DCAA  auditors  did  not  conduct  adequate  follow-up  work  to  ensure  that  the 
work  performed  by  DCMA  personnel  met  the  objectives  of  the  assigned  compliance 
requirements  (Eligibility,  Procurement  and  Suspension  and  Debarment,  and  Sub¬ 
recipient  Monitoring)  and  could  be  relied  on  for  the  0MB  Circular  A- 133  audit.  The 
report  provided  by  DCMA  to  DCAA  did  not  address  the  objectives  in  the  compliance 
supplement  for  the  assigned  areas.  For  example,  SRI  International  passed-through 
$43.7  million  to  sub-recipients  during  FY  1999.  The  compliance  requirements  for 
Sub-recipient  Monitoring  state  that  the  auditor  must  determine  whether  the  pass-through 
entity  (SRI  International)  monitored  its  sub-recipients'  activities  to  provide  reasonable 
assurance  that  the  sub-recipient  administered  Federal  awards  in  compliance  with 
requirements.  The  DCMA  report  provided  to  DCAA  as  support  for  the  compliance  of 
SRI  International  with  the  requirements  for  Sub-recipient  Monitoring  discusses  the 
policies  and  procedures  related  to  contract  negotiations  that  SRI  International  has  in 
place,  but  not  whether  SRI  International  actually  monitored  its  sub-recipients.  DCMA 
personnel  stated  that  they  used  data  from  a  Contractor  Purchasing  System  Review 
(CPSR)  conducted  in  FY  1998  to  determine  if  SRI  International  was  managing  their 
systems  “adequately”  in  the  context  of  the  assigned  compliance  requirements.  The 
CPSR  does  not  specifically  address  the  issue  of  sub-recipient  monitoring,  and  does  not 
provide  enough  information  to  make  a  determination  whether  the  recipient  is 
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monitoring  the  0MB  Circular  A- 133  compliance  of  its  sub-recipients.  DCMA 
personnel  did  not  perform  any  additional  work  to  answer  the  objectives  of  the 
compliance  requirements.  In  addition,  DCMA  personnel  did  not  document  any 
summaries  or  conclusions  on  the  CPSR  data  that  was  used  to  develop  the  report 
provided  to  DCAA. 

DCAA  auditors  relied  on  the  work  performed  by  DCMA  personnel  because  the  lead 
DCMA  reviewer  was  considered  an  “expert”  in  his  field.  DCAA  did  not  review  the 
documentation  of  the  work  performed  by  DCMA  personnel  in  order  to  gain  knowledge 
of  the  actual  work  performed  and  results  obtained,  as  required  by  DCAA  guidance.  As 
a  result  of  our  review,  DCAA  personnel  conducted  discussions  with  DCMA  personnel 
and  the  Administrative  Contracting  Officer  regarding  the  work  program  that  was  used 
by  DCMA.  Based  on  a  comparison  between  the  DCMA  work  program  and  DCAA 
audit  program,  DCAA  personnel  believed  that  the  work  performed  was  adequate. 

Recommendation  A.  We  recommend  that  the  Branch  Manager,  Silicon  Valley  Branch 
Office,  DCAA  evaluate  the  work  performed  by  technical  specialists  in  accordance  with 
the  DCAA  Contract  Audit  Manual  to  ensure  that  the  technical  specialist  procedures  and 
assumptions  answer  the  compliance  objectives  for  the  assigned  areas. 

Management  Comments.  Management  concurred  with  the  recommendation.  DCAA 
personnel  stated  that  they  will  obtain  a  reasonable  understanding  of  the  actual  work 
performed  by  technical  specialists  in  future  audits  before  relying  on  their  work. 

Finding  B.  Planning  and  Documenting  the  FY  1999  0MB  Circular  A-133  Audit. 

DCAA  auditors  did  not  properly  plan  and  document  the  0MB  Circular  A-133  audit  of 
SRI  International.  Specifically,  the  DCAA  auditors  did  not: 

•  use  the  appropriate  0MB  Circular  A-133  Compliance  Supplement; 

•  properly  determine  the  threshold  for  major  programs  at  SW  International; 

•  correctly  determine  the  amount  of  substantive  testing  required,  based  on  the 
results  of  the  risk  assessment;  and 

•  adequately  document  the  work  performed,  to  include  cross-referencing 
between  detail  workpapers  and  audit  conclusions. 

This  condition  occurred  because  DCAA  auditors  involved  in  planning  and  documenting 
the  audit  did  not  have  adequate  0MB  Circular  A-133  training,  and  did  not  implement 
the  training  they  received.  In  addition,  DCAA  auditors  did  not  follow  other  guidance 
related  to  OMB  Circular  A-133  audits  (Government  Auditing  Standards  [GAS],  and  the 
DCAA  Contract  Audit  Manual).  As  a  result,  DCAA  did  not  conduct  a  thorough  audit 
that  provided  a  reasonable  justification  for  the  conclusions  on  two  of  nine  applicable 
compliance  requirements  reported  in  the  FY  1999  OMB  Circular  A-133  audht  report 
(See  Appendix  A  for  a  list  of  the  applicable  compliance  requirements). 

OMB  Circular  A-133  requires  that  audits  be  conducted  in  accordance  with  GAS,  and 
that  the  audits  meet  certain  OMB  Circular  A-133  requirements.  DCAA  auditors  did 
not  meet  these  requirements  in  the  following  areas: 

Appropriate  Compliance  Supplement.  DCAA  auditors  used  the  March  2000 
OMB  Circular  A-133  Compliance  Supplement  to  conduct  the  SRI  International  FY 
1999  OMB  Circular  A-133  audit.  The  correct  Compliance  Supplement  for  FY  1999 
audits  under  OMB  Circular  A-133  was  issued  in  April  1999.  The  April  1999 
Compliance  Supplement  was  effective  for  audits  of  fiscal  years  beginning  after  June  30, 
1998;  SRI  International’s  FY  1999  began  December  26,  1998. 
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Determination  of  Major  Programs.  During  their  determination  of  major 
programs,  DCAA  auditors  used  the  lesser  of  three  percent  of  total  Federal  expenditures 
or  $3  million  as  the  threshold  for  Type  A  programs.  0MB  Circular  A-133  requires 
auditors  to  use  the  greater  of  three  percent  of  total  Federal  expenditures  or  $3  million 
(for  auditees  whose  Federal  awards  expended  exceed  $100  million  but  are  less  than  or 
equal  to  $10  billion). 

Determination  of  Substantive  Testing.  During  the  risk  assessment,  DCAA 
auditors  concluded  that  die  overall  risk  was  “moderate,”  and  that  increased  substantive 
testing  was  warranted.  However,  because  SRI  International  offered  a  $4  million 
voluntary  deletion,  DCAA  auditors  determined  diat  any  potential  questioned  costs  they 
found  would  be  less  than  that,  so  the  increased  substantive  testing  was  not  performed. 
Although  this  logic  makes  sense  for  compliance  requirements  that  involved  potential 
questioned  costs  (for  instance,  Allowable/Unallowable  Costs,  or  Cost  Principles);  it 
does  not  reduce  the  risk  of  non-compliance  for  requirements  that  are  not  cost  driven, 
such  as  Sub-recipient  Monitoring  and  Special  Tests  and  Provisions.  Therefore,  DCAA 
should  not  have  decreased  the  substantive  testing  for  the  non  cost-related  compliance 
requirements  based  on  the  SRI  voluntary  deletion. 

Documentation  of  Work  Performed.  DCAA  did  not  adequately  document  the 
work  performed  during  the  FY  1999  audit,  including  references  of  audit  conclusions  to 
the  detail  working  papers  that  supported  the  conclusions.  The  GAS  state  that  working 
papers  serve  three  purposes:  provide  principal  support  for  the  auditors’  report;  aid  the 
auditors  in  conducting  and  supervising  the  audit;  and  allow  others  to  review  the  audit’s 
quality.  During  extensive  discussions  with  DCAA  auditors,  we  found  that  many  of  the 
conclusions  reached  during  the  FY  1999  audit  were  based  on  work  performed  during 
the  FY  1998  0MB  Circular  A-133  audit  and  other  previous  assignments.  However,  the 
working  papers  written  during  the  FY  1999  audit  did  not  provide  an  audit  trail  to  the 
audit  assignments  or  specific  working  papers  used  to  support  their  conclusions  during 
the  FY  1998  audit.  In  addition,  DCAA  auditors  did  not  adequately  document  the 
materiality  decisions  for  individual  compliance  requirements  within  the  major  program 
(Research  and  Development  Cluster).  GAS  requires  working  papers  to  document  the 
work  performed  to  support  significant  conclusions.  Determinations  regarding  the 
materiality  of  compliance  requirements  for  the  FY  1999  0MB  Circular  A-133  audit 
were  documented  on  a  working  paper  that  consisted  of  a  table  with  “Yes”  or  “No” 
written  in  for  each  compliance  requirement.  There  were  no  explanations  for  the 
conclusions.  Therefore,  we  could  not  determine  the  criteria  or  the  basis  for 
conclusions.  As  a  result  of  our  review,  DCAA  auditors  agreed  to  better  document  the 
support  for  audit  conclusions. 

DCAA  auditors  involved  in  planning  and  supervising  the  FY  1999  0MB  Circular 
A-133  audit  did  not  receive  adequate  training  in  conducting  0MB  Circular  A-133 
audits.  Two  members  of  the  au^t  team  received  formal  training  in  conducting  0MB 
Circular  A-133  audits  from  DCAA  Headquarters.  The  two  members  provided 
information  received  during  this  training  to  the  rest  of  the  team  who  conducted  work 
during  the  FY  1999  0MB  Circular  A-133  audit  of  SRI  International.  However, 
members  of  the  team  stated  that,  in  some  cases,  they  did  not  understand  the 
requirements  of  the  guidance.  In  addition,  DCAA  relied  on  work  performed  during 
other  audit  assignments  to  fulfill  many  0MB  Circular  A-133  requirements.  However, 
DCAA  auditors  did  not  realize  that,  in  some  cases,  it  was  necessary  to  perform 
additional  work  to  answer  the  audit  objectives  of  the  FY  1999  0MB  Circular  A-133 
audit.  As  a  result,  key  aspects  of  0MB  Circular  A-133  audits  were  not  performed 
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correctly  during  FY  1999.  As  a  result  of  our  review,  DCAA  auditors  agreed  to  take  a 
closer  look  at  the  regulations  and  guidance  related  to  0MB  Circular  A-133  audits,  and 
ensure  that  any  conclusions  reached  are  adequately  supported. 

Conclusion.  Without  the  proper  training  and  guidance  necessary  to  conduct  0MB 
Circular  A-133  audits,  DCAA  auditors  failed  to  properly  plan  and  document  the  SRI 
International  FY  1999  audit.  To  prevent  this  from  happening  in  future  audits,  DCAA 
auditors  must  receive  formal  training  in  the  performance  of  0MB  Circular  A-133 
audits,  and  apply  the  training  to  the  audit  work.  In  addition,  DCAA  auditors  should 
perform  proper  testing  of  SM  International  compliance  with  internal  controls  and 
compliance  requirements  during  the  FY  2000  audit,  and,  based  on  the  results  of  this 
testing,  determine  whether  they  need  to  perform  additional  testing  for  FY  1999 
transactions. 

Recommendation  B.l.  We  recommend  that  the  Branch  Manager,  Silicon  Valley 
Branch  Office,  DCAA  provide  training  for  auditors  involved  in  Office  of  Management 
and  Budget  Circular  A-133  audits.  We  also  recommend  that  DCAA  supervisors 
involved  in  SRI  International  audits  ensure  that  all  applicable  regulations  and  guidance 
are  followed. 

Management  Comments.  Management  concurred  with  the  recommendation.  DCAA 
personnel  stated  that  all  but  one  of  the  auditors  involved  in  the  FY  2000  0MB  Circular 
A-133  audit  at  SRI  International  had  received  training,  and  that  the  one  remaining 
auditor  was  closely  supervised. 

Recommendation  B.2.  We  recommend  that  the  Branch  Manager,  Silicon  Valley 
Branch  Office,  DCAA  instruct  auditors  to  perform  proper  testing  of  SRI  International 
internal  controls  and  compliance  requirements  during  the  FY  2000  Office  of 
Management  and  Budget  Circular  A-133  audit.  We  also  recommend  that  if  DCAA 
auditors  performing  the  FY  2000  audit  determine  that  there  are  findings  related  to 
internal  control  or  compliance  requirements,  the  Branch  Manager,  Silicon  Valley 
Branch  Office,  DCAA  should  determine  whether  additional  testing  or  a  second  audit 
needs  to  be  performed  for  FY  1999. 

Management  Comments.  Management  concurred  with  the  recommendation.  DCAA 
personnel  stated  that  auditors  increased  their  substantive  testing  during  the  FY  2000 
0MB  Circular  A-133  audit  of  SRI  International,  and  concluded  that  there  was  a  finding 
related  to  Sub-recipient  Monitoring.  After  reviewing  the  finding  as  it  applied  to  the 
FY  1999  audit,  DCAA  auditors  determined  that  no  additional  testing  was  necessary. 

Finding  C.  SRI  International  reporting  to  the  Federal  Clearinghouse  on  the  0MB 
Circular  A-133  audit  for  FY  1999  was  incomplete.  Specifically: 

•  SRI  International  did  not  identify  expenditures  received  as  pass-through 
awards  in  the  FY  1999  Single  Audit  Report.  0MB  Circular  A-133  states 
that  auditees  are  to  prepare  a  Schedule  of  Expenditures  of  Federal  Awards. 
For  Federal  awards  received  as  a  sub-recipient,  the  auditee  shall  identify  the 
name  of  the  pass-through  entity  and  identifying  number  assigned  by  the 
pass-through  entity.  SRI  International  expended  $27.0  million  received  from 
pass-through  entities  out  of  $130.3  million  total  Federal  award  expenditures 
for  FY  1999. 


5 


•  SRI  inchided  a  corrective  action  plan  to  address  the  deficimcies  that  the 
DCAA  identified  in  its  audit  rqwrt;  however,  die  corrective  action  plan  did 
not  specify  a  planned  completion  date  or  a  point  of  contact.  0MB  Circular 
A-133  requires  anditees  to  prepare  a  corrective  action  that  provides  the 
name(s)  of  the  contact  person(s)  responsible  for  corre^ye  action,  the 
corrective  action  plami^,  and  the  antic4>ated  completion  date. 

During  discussions  with  SRI  International  personnel,  they  indicated  tiiat  they  did  not 
interpret  the  requironents  in  the  same  way  as  we  did.  However,  they  were  able  to 
provide  the  correct  information  during  the  review.  As  a  result  of  our  review,  SRI 
Intmiational  personnel  agreed  to  provide  tins  infom^on  in  future  audit  report 
packages. 

Recommendation  C.  We  recommend  that  in  future  audits,  ContioUer,  SRI 
Tntamatinnal  prepare  the  Schedule  of  E;q)enditures  of  Federal  Awards  and  the 
Corrective  Action  Ran  in  accordance  witih  tibe  Office  of  Management  and  Budget 
Circular  A-133. 


Management  Comments.  Management  concurred  with  the  recommendation.  The 
Controller,  SRI  agre^  to  include  the  information  r^piired  by  Office  of  Management 
and  Budget  Circular  A-133  in  hUure  audit  report  packages. 


We  appredate  the  courtesies  extouled  during  tiie  review.  If  you  have  questions  on  this 
report,  please  contact  I^.  Wayne  Berry  at  (703)  604-8789  or  Mr.  Martin  T.  Heacock 
at  (703)  604-87^.  Ap^ndix  B  lists  tiie  r^ort  distribution.  The  review  team  members 
are  listed  inside  foe  back  cover. 
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Appendix  A.  Quality  Control  Review  Process 


Scope  and  Methodology 

We  conducted  a  quality  control  review  of  the  DCAA  and  KPMG  LLP  audit  of 
SRI  International  for  the  fiscal  year  ended  December  25,  1999,  and  the  resulting 
reporting  submission  to  the  Single  Audit  Clearinghouse  on  September  29,  2000 
(Project  No.  D2001-OA-0108).  We  performed  our  review  using  the  1999 
edition  of  the  “Uniform  Quality  Control  Guide  for  0MB  Circular  A-133 
Audits”  (the  Guide).  The  Guide  applies  to  any  single  audit  that  is  subject  to  the 
requirements  of  0MB  Circular  A-133,  revised  June  24,  1997.  The  Guide  is  the 
approved  checklist  of  the  President’s  Council  on  Integrity  and  Efficiency  for 
performing  quality  control  reviews.  Our  review  was  conducted  from  April  2001 
through  December  2001  and  covered  areas  related  to  the  financial  statements 
and  the  one  major  program,  research  and  development.  As  the  cognizant  audit 
agency  for  SRI  International,  we  focused  our  review  on  the  following  qualitative 
aspects  of  the  single  audit: 

•  qualification  of  auditors 

•  independence 

•  due  professional  care 

•  quality  control 

•  planning  and  supervision 

•  internal  controls  and  compliance  testing 

•  Schedule  of  Expenditures  of  Federal  Awards 

•  Schedule  of  Findings  and  Questioned  Costs 

•  Data  Collection  Form 

In  conducting  the  review,  we  reviewed  all  working  papers  prepared  by  DCAA 
and  KPMG  LLP  auditors,  discussed  the  audit  with  the  auditors  and  SRI 
International  cognizant  personnel,  and  reperformed  selected  audit  procedures. 


Prior  Quality  Control  Reviews 

Since  1997,  we  have  issued  eight  quality  control  reviews  of  DCAA,  and  four 
quality  control  reviews  of  KPMG  LLP.  We  have  also  issued  four  quality 
control  reviews  of  audits  performed  jointly  by  DCAA  and  KPMG  LLP.  Copies 
of  these  reports  may  be  obtained  by  accessing  the  Defense  Inspector  General 
web  page  at  www.dodig.osd.mil. 
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Single  Audit  Requirements 

0MB  Circular  A-133  establishes  policies  to  guide  implementation  of  the  Single 
Audit  Act  of  1996  (Public  Law  98-502)  amendments  and  provides  an 
administrative  foundation  for  uniform  audit  requirements  for  non-Federal 
entities  that  administer  Federal  awards.  In  addition,  0MB  Circular  A-133 
serves  to  ensure  that  Federal  departments  and  agencies  rely  on  and  use  the  audit 
work  to  the  maximum  extent  practicable.  To  meet  the  intent  of  the  law  and 
0MB  Circular  A-133,  a  complete  reporting  package  on  each  single  audit  is 
submitted  to  the  Single  Audit  Clearinghouse  from  the  auditee  (non-Federal 
entity).  The  reporting  package  includes  the  following: 

•  Data  Collection  Form  certified  by  the  auditee  that  the  audit  was 
completed  in  accordance  with  0MB  Circular  A-133; 

•  financial  statements  and  related  opinion; 

•  Schedule  of  Expenditures  of  Federal  Awards  and  related  opinion; 

•  report  on  internal  controls  over  compliance  and  on  compliance  with 
laws,  regulations,  and  the  provisions  of  contracts  or  grant 
agreements,  and  related  opinion  on  compliance  of  major  programs; 
and 

•  Schedule  of  Findings  and  Questioned  Costs. 

0MB  also  issues  a  Compliance  Supplement  (the  Supplement).  The  Supplement 
assists  the  auditors  in  determining  the  audit  scope  of  0MB  Circular  A-133 
requirements  for  review  of  internal  control.  For  each  compliance  requirement, 
the  Supplement  describes  the  objectives  of  internal  control  and  certain 
characteristics  that,  when  present  and  operating  effectively,  may  ensure 
compliance  with  program  requirements.  The  Supplement  gives  examples  of  the 
common  characteristics  for  the  five  components  of  internal  controls  (control 
environment,  risk  assessment,  control  activities,  information  and 
communication,  and  monitoring)  for  each  compliance  requirement.  The 
following  14  compliance  requirements  applicable  to  various  Federal  programs 
are  identified  in  the  Supplement: 
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A.  Activities  Allowed/Unallowed* 

H.  Period  of  Availability  of  Federal 

Funds* 

B.  Allowable  Costs/Cost  Principles* 

I.  Procurement  and  Suspension  and 
Debarment* 

C.  Cash  Management 

J.  Program  Income 

D.  Davis-Bacon  Act 

K.  Real  Property  Acquisition/Relocation 
Assistance 

E.  Eligibility  of  Federal  Fimds* 

L.  Reporting 

F.  Equipment  and  Real  Property 
Management* 

M.  Sub-recipient  Monitoring* 

G.  Matching,  Level  of  Effort, 

Earmarking* 

N.  Special  Tests  and  Provisions* 

*  Identifies  those  compliance  requirements  applicable  to  SRI  International,  as  determined  by  DCAA 
during  the  FY  1999  0MB  Circular  A-133  audit. 
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Appendix  B.  Report  Distribution 


Mr.  Byron  Rovegno,  Controller 
SRI  International 
333  Ravenswood  Avenue 
Menlo  Park,  CA  94025 

Mr.  Steve  Devetter,  Partner 
KPMG  LLP 

3  Embarcadero  Center,  Room  2000 
San  Francisco,  CA  94111 

Director 

Defense  Contract  Audit  Agency 
8725  John  J.  Kingman  Road 
Suite  2353 

Fort  Belvoir,  VA  22060-6219 
Director 

Defense  Contract  Management  Agency 
6350  Walker  Lane,  Suite  300 
Alexandria,  VA  22310-3241 

Director,  Defense  Procurement 
Office  of  the  Under  Secretary  of 
Defense  for  Acquisition,  Technology, 
and  Logistics 

3060  Defense  Pentagon,  Room  3E1044 
Washington,  DC  20301-3060 

Defense  Advance  Research  Projects 
Agency 

Director,  Contracts  Management  Office 
Attn:  Mr.  R.  Timothy  Arnold 
3701  North  Fairfax  Drive 
Arlington,  VA  22203-1714 

Department  of  the  Air  Force 
Office  of  the  Assistant  Secretary 
(Financial  Management  &  Controller) 
Attn:  Director,  Audit  Liaison 
(SAF/FMPF) 

1130  Air  Force  Pentagon,  Room  4D212 
Washington,  DC  20330-1130 


Department  of  the  Navy 
Assistant  Secretary  of  die  Navy 
(Financial  Management  & 
Comptroller) 

Attn:  Audit  Liaison  Branch  (FMO-31) 
1000  Navy  Pentagon,  Room  1 15 
Washington,  DC  20350-1000 

Department  of  the  Army 
Deputy  Assistant  Secretary  of  the  Army 
for  Financial  Management  & 
Comptroller 

Financial  and  Accounting  Oversight 
Division 

0109  Army  Pentagon,  Room  3E588 
Washington,  DC  20310-0109 

Regional  Inspector  General 
U.S.  Department  of  Commerce 
401  West  Peachtree  Street,  NW 
Suite  2742 
Atlanta,  GA  30308 

Director,  Non-Federal  Audits 
Office  of  Inspector  General 
U.S.  Department  of  Education 
1999  Bryan  Street,  Suite  2630 
Dallas,  TX  75201-6817 

U.S.  Department  of  Energy 
Office  of  Inspector  General 
Atm:  Single  Audit  Contact 
1000  Independence  Avenue,  SW 
IG-33,  Room  5A-193 
Washington,  DC  20585 

Non-Federal  Audits 
HHS  OIG  National  External  Audit 
Resources 
Lucas  Place 

323  West  8*  Street,  Room  514 
Kansas  City,  MO  64105 
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Appendix  B.  Report  Distribution  (Cont’d) 


U.S.  Department  of  Transportation 
Office  of  Inspector  General  JA-20 
400  7'"  Street  SW,  Room  9228 
Washington,  DC  20590 

USAID 

Attn:  OIG/A/FA 
Room  8.10-10 

1300  Pennsylvania  Avenue,  NW 
Washington,  DC  20523-7802 

National  Single  Audit  Coordinator 
Office  of  Inspector  General 
Mid- Atlantic  Audit  Division 
U.S.  Environmental  Protection  Agency 
3AI00  1630  Arch  Street,  3^^  Floor 
Philadelphia,  PA  19103-2029 

NASA  Office  of  Inspector  General 
NASA  Headquarters,  Code  W 
3000  E  Street,  SW,  Room  8T79 
Washington,  DC  20546-0001 

Office  of  Inspector  General 
National  Science  Foundation 
Assistant  Inspector  General  for  Audit 
4201  Wilson  Boulevard,  Suite  1135 
Arlington,  VA  22230 

Department  of  State 
Office  of  Inspector  General 
OIG/AUD/CG 

1700  North  Moore  Street,  Room  720 
Arlington,  VA  22209 
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Defense  Contract  Audit  Agency 
Comments 


DEFENSE  CONTRACT  AUDIT  AGENCY 
DEPARTMENT  OF  DEFENSE 

8725  JOHN  J,  KINGMAN  ROAD,  SUITE  2135 
FORT  BELVOm,  VA  22060-6219 


PQA2254(D2001-OA-0108)  December  7,  2001 

MEMORANDUM  FOR  DEPUTY  ASSISTANT  INSPECTOR  GENERAL,  AUDIT  POLICY 
AND  OVERSIGHT,  DEPARTMENT  OF  DEFENSE,  INSPECTOR 
GENERAL 

SUBJECT:  DCAA  Comments  on  the  Discussion  Draft  of  DoDIG  Report  on  the  Quality  Control 
Review  of  SRI  Intemationars  FY 1999  0MB  Circular  A-133  Audit,  Project  No. 
D2001-OA-0108 

Thank  you  for  the  opportunity  to  respond  to  the  discussion  draft  report.  The  subject 
report  provides  the  results  of  your  office’s  quality  control  review  of  the  OMB  Circular  A-133 
audit  performed  at  SRI  Intemational  for  fiscal  year  (FY)  1999.  KPMG  LLP  and  DCAA 
performed  the  audit  on  a  coordinated  basis. 

DCAA  concurs  with  the  three  recommendations  presented  in  the  subject  report. 

Enclosed  are  our  comments  to  each  of  the  six  discussion  draft  quality  control  findings  supporting 
your  three  recommendations.  We  will  ensure  that  future  fiscal  year  audits  at  SRI  Intemational 
include  consideration  for  each  of  the  reported  findings. 

If  you  have  any  questions,  please  contact  me  at  (703)  767-3280  or  Marc  Parvin, 

Program  Manager  at  (703)  767-2250.  Our  e-mail  addresses  are  larry.uhlfelder@dcaa.mil  and 
marc.parvin@dcaa,inil. 

f  Lawrence  P.  Uhlfelder 

Assistant  Director 
Policy  and  Plans 

Enclosure: 

Western  Region  Response  Dated  Dec  7, 2001 
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WESHERN  REGION 

DEFENSE  CONTRACT  AUDIT  AGENCY 
16700  VALLEY  VIEW  AVENUE,  SUITE  300 
LA  MIRADA,  CALIFORNIA  90638-5833 

RQA-4  225.4  December  7, 2001 

MEMORANDUM  FOR  DEPUTY  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDIT 
POLICY  AND  OVERSIGHT.  AUD/APO,  ROOM  746, 

400  ARMY  NAVY  DRIVE.  ARLINGTON,  VA  22202-2885 

SUBJECT:  Response  to  Discussion  Draft  of  a  Proposed  Report  on  Quality  Control  Review  of 
OMB  Circular  A-133  Au<it  of  SRI  Intemationd  for  Fiscal  Year  (FY)  Ended 
December  25, 1999,  DoDIG  Project  No.  D2001-OA-0108 

Thank  you  for  the  opportunity  to  respond  to  the  referenced  discussion  draft  report. 
Although  we  agree  with  the  three  recommendations,  we  offer  the  following  comments  on  the 
issues  raised  in  the  subject  discussion  draft  report: 

1.  Oversight  of  Work  Performed  by  Technical  Specialists 

Your  concern  is  whether  we  performed  sufficient  effort  to  ensure  that  we  could  place 
reliance  on  the  work  of  Defense  Contract  Management  Agency  (DCMA)  technical  specialists 
reviewing  SRI’s  purchasing  system. 

In  response  to  your  initial  concerns  several  months  ago,  we  coordinated  with  both  the 
DCMA  Contractor  Purchasing  System  Review  (CPSR)  Team  Captain  and  the  Administrative 
Contracting  Officer  and  reviewed  applicable  working  papers  prepared  by  the  CPSR  team. 
Additionally,  the  CPSR  team  performed  its  triennial  review  in  FY  2001  using  FY  2000  data. 
Between  our  FY  2000  audit  effort  and  assessment  of  the  CPSR  team’s  effort,  we  performed 
some  additional  audit  effort  during  our  A-133  audit  for  FY  2000  which  resulted  in  a  finding 
related  to  compliance  requirement  M,  Sub-recipient  Monitoring.  While  this  finding  has 
applicability  to  FY  1999,  in  our  opinion,  it  would  serve  no  useful  purpose  to  supplement  our  FY 
1999  audit  report.  The  finding  is  procedural  in  nature,  primarily  affects  contract  closings  and  is 
being  addressed  by  SRI.  We  included  documentation  of  this  assessment  in  our  FY  1999  working 
papers. 

In  future  audits,  we  will  obtain  a  reasonable  understanding  of  the  actual  work  performed 
before  relying  on  the  work  of  the  government  technical  specialist. 

2.  Use  of  Appropriate  Compliance  Supplement 

The  auditors  relied  on  the  March  2000  OMB  Circular  A-133  Compliance  Supplement 
rather  than  the  April  1999  Compliance  Supplement  which  was  appropriate  for  the  year  being 
audited.  We  compared  the  April  1999  and  March  2000  Compliance  Supplements  and  found 
there  were  no  substantive  differences  between  the  two  supplements  that  would  have  impacted 
our  audit.  Therefore,  our  use  of  the  March  2000  Compliance  Supplement  had  no  impact  on  our 
audit 


Enclosure 
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Final  Report 
Reference 


RQA-4  225.4 

SUBJECT:  Response  to  Discussion  Draft  of  a  Proposed  Report  on  Quality  Control  Review  of 
ONffl  Circular  A-133  Audit  of  SRI  International  for  Fiscal  Year  (FY)  Ended 
December  25, 1999,  DoDIG  Project  No.  D2001-OA-0108 

3.  Determination  of  Major  Programs 

The  auditors  did  compute  an  incorrect  threshold  for  determining  major  programs. 
However,  SRI*s  effort  is  primarily  research.  Therefore,  the  auditors  appropriately  classified  all 
of  SRFs  government  work  as  one  program,  a  Research  and  Development  Cluster.  Thus,  use  of 
an  incorrect  threshold  had  no  impact  on  our  audit. 

4.  Level  of  Substantive  Testing 

You  raised  concerns  about  our  level  of  substantive  testing  for  three  of  the  nine 
compliance  requirements  (Sub-recipient  Monitoring,  Special  Tests  and  Provisions,  and 
Reporting).  We  reduced  our  level  of  substantive  testing  for  the  audit  because  SRI  offered  a 
$4  million  voluntary  reduction  to  incurred  indirect  expenses.  However,  since  these  three 
compliance  requirements  cover  both  qualitative  and  quantitative  aspects,  the  concern  was 
whether  or  not  a  monetary  reduction  was  sufficient  basis  to  reduce  substantive  testing  for 
qualitative  requirements.  We  will  ensure  that  future  A- 133  audits  include  proper  testing  of  SRI 
internal  controls  and  compliance  for  all  applicable  compliance  requirements.  In  addition,  we 
offer  the  following  comments: 

a.  Sub-recipient  Monitoring  and  Special  Tests  and  Provisions 

We  increased  our  substantive  testing  during  our  FY  2000  audit  and,  based  on  the 
results  of  that  audit,  and  as  discussed  in  paragraph  1  above,  we  do  not  believe  that  additional 
audit  work  or  a  supplemental  report  is  warranted  for  the  FY  1999  audit. 

b.  Reporting 

It  appears  that  your  concern  should  not  encompass  the  Reporting  compliance 
requirement.  On  Page  9  of  your  discussion  draft  you  acknowledge  that  this  requirement  is  one  of 
five  compliance  requirements  that  were  not  applicable  to  SRI  in  FY  1999. 

5.  Documentation  of  Work  Performed 

We  agree  the  working  paper  documentation  could  have  been  better  in  the  FY  1999 
working  papers.  We  will  improve  documentation  to  support  our  audit  conclusions  in  working 
papers  for  future  audits.  We  believe  the  working  paper  documentation  for  our  FY  2000  audit  is 
sufficient  based  on  incorporating  DoDIG  suggestions  we  received  during  the  field  visit  in  this 
audit. 


6.  Training 

We  agree  that  all  auditors  with  significant  involvement  in  the  OMB  Circular 


Removed 
the  word 
Reporting, 
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RQA-4  225.4 

SUBJECT:  Response  to  Discussion  Draft  of  a  Proposed  Report  on  Quality  Control  Review  of 
0MB  Circular  A>133  Audit  of  SRI  International  for  Fiscal  Year  (FY)  Ended 
December  25»  1999,  DoDIG  Project  No.  D2001-OA-0108 

A-133  audit  should  receive  training  on  0MB  Circular  A-133.  For  the  FY  2000  audit  all  but  one 
auditor  assigned  to  the  audit  received  the  training.  The  one  auditor  was  closely  supervised  and 
the  work  was  peer  reviewed  by  an  auditor  who  was  trained  on  A-133  requirements. 


Thank  you  again  for  working  with  our  FAO  on  the  findings  and  the  opportunity  to 
comment  on  the  discussion  draft  report.  If  you  have  any  questions,  please  contact  Mr.  Rod 
Beavers,  Silicon  Valley  Branch  Office  Manager,  at  (408)  523-5000,  or  Mr.  Harry  Lorsbach, 
Chief,  Regional  Quality  Assurance  Division,  at  (510)  742-2123.  Our  email  addresses  are  dcaa- 


fao4291  @dcaa.mil  and  harrv.lorsbach@dcaa.mil. 


Copy  furnished: 
RAMD4 
FAO  4291 


/s/ Patricia  A.  Ferrer 
/for/  WILLIAM  R.  SERAFINE 
Regional  Director 
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Final  Report 
Reference 


SRI  International  Comments 


Rainey,  Laura  A, 

From: 

Sent: 

To: 

Subject: 


Byron  P  Rovegno  [byron.rovegno@sri.com] 
Thursday,  December  06,  2001  1 :00  AM 
Laura  Rainey 
Discussion  Draft 


Card  for  byron 
rovegno 

Although  it  is  late  on  12/5  here  in  California,  I  am  replying  timely  to 
the  discussion  draft  you  sent.  {It  has  been  a  long  day!] 

.1  have  the  following  comments: 

Regarding  the  second  bullet  in  the  Finding  C,  DCAA  knows  that  I  am  the 
point  of  contact  and  I  periodically  discuss  our  schedule  and  progress 
with  them.  This  level  of  detail  has  not  been  provided  to  the 
Clearinghouse  as  part  of  our  report.  Results  achieved  are  clear  when 
subsequent  A-133  reports  are  submitted  and  the  corrective  actions  taken 
clear  issues  previously  noted. 

The  last  paragraph  in  the  Finding  C  should  state: 

"During  discussions  with  SRI  International  personnel,  they  indicated 
that  they  did  not  interpret  these  requirements  in  the  same  way  as  the 
auditor.  Nevertheless,  as  a  result  of  our  review,  SRI  International  has 
agreed  to  provide  this  information  to  the  auditor  and  will  include  in 
future  audit  report  packages  the  proper  details  related  to  subrecipient 
awards.  In  fact,  SRI  International  provided  the  subrecipient  award 
information  to  the  auditor  during  the  course  of  our  audit . " 

Please  let  me  know  if  you  have  any  questions.  Tomorrow  is  not  a  good 
day,  but  I  should  be  in  the  office  most  of  the  time  on  friday.  My  number 
is  650  859-4304. 
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Review  Team  Members 

The  Deputy  Assistant  Inspector  General  for  Audit  Policy  and  Oversight,  Office  of  the 
Assistant  Inspector  General  for  Auditing,  DoD,  prepared  this  report.  Personnel  of  the 
Office  of  the  Inspector  General,  DoD,  who  contributed  to  the  report,  are  listed  below. 

Wayne  C.  Berry 
Martin  T.  Heacock 
Laura  A.  Rainey 
Krista  S.  Gordon 


